Advertise on podcast: Future of Threat Intelligence

Paul McCarty and Jenn Gile, Co-Founders of OpenSourceMalware, join Eli Woodward to discuss how malicious open source packages have become a major software supply chain attack vector, and why most organizations lack the visibility and threat data to defend against them. Topics discussed: Defining open source malware across packages, extensions, and repos Team PCP’s credential hoarding and multi-wave attack strategy Account takeovers versus “bad from the start” malicious packages DPRK’s Contagious Interview and Task Jacker campaigns Using GitHub as backup C2 for exfiltrated credentials Bridging the gap between CTI teams and application security Malicious AI agent skills as a new attack surface Key Takeaways: Audit single-maintainer packages in your dependency tree, especially those with high download counts, to identify supply chain concentration risk Rotate all credentials immediately after a supply chain compromise, prioritizing short-lived tokens that attackers sort and exploit first Integrate malicious open source threat feeds into your threat intelligence platform and disseminate indicators across CTI, AppSec, and SOC teams Train developers to recognize Contagious Interview tactics, including fake recruiter outreach and take-home coding assessments that deliver malware through forked repos Monitor GitHub for unauthorized public repositories created in your organization’s accounts, which attackers use as encrypted backup C2 for stolen credentials Evaluate AI agent skill registries with the same rigor as package registries, since natural language payloads bypass traditional static analysis tools Designate a central owner for malicious open source intelligence who connects development, application security, and threat hunting teams Listen to More Episodes:  YouTube  •  Apple  •  Spotify  •  Website

Early cybercrime forums operated almost entirely in Russian, creating a barrier to entry that kept most analysts out. Amanda Lerner, Ph.D., Lead Cyber Threat Intelligence Analyst in financial services, broke through with a Yale PhD in Russian literature and the cultural fluency to decode dark web “Ringlish.” Amanda tells Eli how she went from investigating bitcoin mixing services at the Manhattan DA’s Cyber Intelligence Unit to leading CTI in the financial sector, and why LLMs lower the language barrier but cannot replace the cultural context real threat intelligence requires. Topics discussed: How Russian became the lingua franca of cybercrime Decoding “Ringlish” slang on dark web criminal forums From Yale Russian literature PhD to cyber threat intelligence Investigating bitcoin mixing services at the Manhattan DA’s Office Why cultural context still outweighs LLM translation in CTI Cybercrime-as-a-service operations that mirror legitimate businesses Evaluating forum credibility through reputation and thread history How the shrinking Runet shapes adversary worldviews Key Takeaways:  Learn Russian or invest in native-speaking analysts to access cybercrime forums where cultural fluency reveals what translation alone misses. Study the history of CarderPlanet and early Odessa-based carding forums to understand how Russian became the default language of the cybercriminal underground. Recognize “Ringlish” as the true working language of cybercrime forums, a blend of Russian grammar with English technical terms that LLMs still struggle to parse accurately. Use LLMs as a starting point for translating forum content, but always layer in human cultural context to catch slang, sarcasm, and coded language. Treat cybercrime-as-a-service vendors like business competitors by mapping their offerings, pricing, reputation scores, and customer feedback across forums. Verify breach claims on forums by checking the poster’s account age, reputation score, transaction history, and thread responses before escalating internally. Monitor the shrinking Runet to understand how restricted information access shapes Russian-speaking threat actors’ worldviews and operational motivations. Apply academic research methods like source triangulation, fact-checking, and critical reading directly to threat intelligence analysis workflows. Spend dedicated time reading cybercrime forum threads end to end to build intuition for how threat actors communicate and operate. Trace cryptocurrency transactions back to dark web forum advertisements to connect financial flows with specific threat actor personas and campaigns. Listen to More Episodes:  YouTube  •  Apple  •  Spotify  •  Website

Over 60% of false positives trace back to vendor-provided detection rules. That finding, from a first-of-its-kind SANS report Alex Hurtado helped produce, captured why detection engineering has become its own discipline, one that treats rule management like a CI/CD pipeline. Alex, Head of Detection Strategy at Nebulock, breaks down how AI is reshaping the detection lifecycle, from query generation to self-healing alert tuning, and flags a critical blind spot where current logs cannot distinguish a legitimate AI agent action from a malicious one. Topics discussed: Treating detection rule management as a CI/CD pipeline Vendor rules as the leading source of false positives Applying AI to query generation and alert tuning Distinguishing AI slop from actionable threat research Chaining atomic detections across data sources for coverage Closing the visibility gap on AI agent telemetry Open source tools for monitoring AI agent activity Key Takeaways:   Treat detection rule management like a CI/CD pipeline to keep pace with evolving environments and shifting attack surfaces. Audit vendor-provided detection rules first when investigating false positive volume, since they account for over 60% of false positives according to the SANS report. Apply AI to query generation and alert tuning so detection engineers spend less time writing SPL, SQL, or AQL and more time on coverage strategy. Chain atomic detections across multiple data sources and TTPs to build behavior-based alert narratives instead of relying on single-event rules. Curate threat intelligence sources manually before feeding them into AI workflows to filter out AI-generated slop masquerading as research. Evaluate open source AI agent telemetry projects like Perplexity's Numbat and Huntress contributor Anton Uvrotsky's A10 to start building visibility into agent activity. Map your detection backlog against both internal environment changes and external threat landscape shifts to prioritize what to build next. Listen to More Episodes:  YouTube  •  Apple  •  Spotify  •  Website

The euphoria around AI is over, and the flaws are showing up at a speed nobody imagined a year ago. Jim Almerico, CISO at Ironbridge CISO Consulting, tells Eli that organizations deploying AI without understanding how it operates are repeating the mistakes of the early internet and IoT eras. Jim shares lessons from securing PsiQuantum under a 90-day CMMC deadline for a $31 million DARPA contract, why identity access management is the foundation for governing AI agents, and how quantum computing is approaching its tipping point. Topics discussed: Why AI security mirrors early internet and IoT security failures Governing autonomous AI agents through identity access management Completing CMMC certification in 90 days for a DARPA contract How open defender communication would strengthen collective security Preparing encryption and certificates for post-quantum readiness Securing MCP and API connections against unintended data exposure Why blind trust in AI is the biggest organizational risk Key Takeaways:  Require model cards and data flow documentation before deploying AI so security teams know exactly how a system operates before they protect it. Clean up identity access management for knowledge workers first, because AI agents will inherit every unresolved permission in the system. Build AI governance around containment controls, not checklists, since the organizations behind the most advanced AI could not contain their own products. Demand open communication between defender teams, treating shared intelligence as the biggest force multiplier in security. Start quantum readiness now by inventorying encryption and certificates, even though the quantum tipping point may be years away. Audit MCP and API connections for unintended data exposure before integrating AI tools across organizational boundaries. Approach AI adoption with the understanding that both benefits and harm are real, and resist blind trust in any tool your team cannot fully explain. Listen to More Episodes:  ⁠YouTube⁠  •  ⁠Apple⁠  •  ⁠Spotify⁠  •  ⁠Website⁠

In our latest episode of the Future of Threat Intelligence podcast, Mark Kreitzman, Chief Cyber Evangelist at Efani, shares how organized crime is scaling SIM swap attacks with AI, why most U.S. financial institutions still rely on SMS authentication, and how Efani's reversed MVNO model locks every carrier and phone store out of customer accounts. Mark knows these attacks firsthand. In 2017, an attacker ported his number for 61 minutes, stole his crypto, and ported it back to hide the attack. That experience drove him to help build a secure mobile service now protecting executives, crypto holders, and high-net-worth individuals with up to $5 million in insurance backing per customer. Topics discussed: How organized crime and AI are scaling SIM swap attacks from lone hackers to industrial operations Efani's reversed MVNO model that locks carriers, phone stores, and support agents out of customer accounts Why 80% of U.S. financial institutions still default to SMS authentication The Marks and Spencer breach that started with a middle manager's SIM swap and cost 350 million euros How every data breach feeds targeting data to SIM swap attackers Key Takeaways: Separate email accounts across personal, banking, and crypto to prevent a single compromised address from exposing multiple accounts. Replace SMS-based authentication with authenticator apps and hardware keys wherever your financial institutions allow it. Audit which services are tied to your mobile number and remove phone-based recovery from high-value accounts. Assume your personal data is already exposed from past breaches and layer your defenses accordingly. Evaluate your mobile carrier's security model, because the default carrier setup prioritizes convenience over account protection. Monitor unexpected password reset texts or authentication codes as potential reconnaissance by attackers testing your accounts. Protect executive and leadership phone numbers as enterprise attack surfaces, not just personal devices. Listen to More Episodes:  YouTube  •  Apple  •  Spotify  •  Website

Resource constraints, not attacker sophistication, are the biggest cyber threat facing state and local governments, and AI is widening the gap by making low-skill attackers faster and more convincing. In our latest episode of the Future of Threat Intelligence podcast, Randy Rose, VP of Security Operations and Intelligence, Center for Internet Security, shared how community defense, essential controls, and human verification hold the line as phishing and deepfake threat intelligence evolve. Topics discussed: Why resource constraints are the number one cybersecurity challenge for state and local governments How AI makes low-skill attackers faster while ransomware and phishing stay the top threats Mapping CIS Implementation Group 1 controls to top MITRE ATT&CK techniques to reduce risk Why traditional phishing training is obsolete after AI-written phishing and deepfake attacks How community defense turns one organization's attack into protection for thousands Key Takeaways: Prioritize an essential set of controls, starting with CIS Implementation Group 1, to buy down the most risk against top threats like ransomware. Map your controls to the top MITRE ATT&CK techniques so you know which defenses deliver the greatest impact. Retire phishing training built on spotting typos and odd phrasing, and train people for general skepticism instead. Build proactive verification, such as two-person integrity, before trusting an email, phone call, or video feed. Inventory access alongside hardware and software, tracking who and what has access to what, including AI and agent tools. Maintain and exercise an updated incident response plan, and know exactly who to call in each scenario. Use AI for data translation, correlation, and enrichment at scale, and reserve creative thinking and context for people. Listen to More Episodes:  YouTube  •  Apple  •  Spotify  •  Website

Daniel Woods, Principal Security Researcher at Coalition, sits at an intersection most security practitioners never access: underwriting data, claims history, and live forensics findings from the same vantage point. In this conversation, he traces how cyber insurance evolved from a 10% loss ratio product in the late 1990s to carriers reportedly hitting 130%+ during the ransomware era, and what that financial pressure forced the market to actually build. He also explains the mechanics behind why lawyers end up directing IR investigations, who that structure protects, and why every practitioner who has ever written a forensic report should understand it before an incident forces the question. Topics discussed: Early cyber insurance economics and how a near-90% profit margin shaped the market How California's 2003 breach notification law created the data breach litigation economy How the shift from on-site auditors to yes/no questionnaires left insurers blind to whether backups were actually recoverable Why RDP as an initial access vector dropped from roughly 80-90% of ransomware claims to around 20% Why insurers put lawyers in front of IR investigations and what that means for what gets documented The unresolved legal problem with cyber war exclusions along the nation-state/criminal contractor continuum Why security practitioners should be in the room during the insurance buying process, not reacting to the vulnerability report afterward Why cyber insurance is a broad digital risk product and not just a ransomware backstop Key Takeaways: Get your security team into the insurance buying process before the vulnerability report arrives. Once it lands, you are in reactive mode with your carrier already holding findings. Insurers like Coalition built their underwriting model around external perimeter scanning, specifically flagging open RDP, VPNs without MFA, and exposed attack surface before they quote. That scan is happening whether your team engages with it or not. Use it. The backup question on an insurance application has moved well past yes or no. Insurers now ask about recovery time, maintenance cadence, and whether backups are actually tested. A tape environment that takes two months to restore is not a recovery capability and carriers know it. When a lawyer is directing your IR investigation, what goes into the forensic report is a legal decision, not just a technical one. Daniel's own interview research with lawyers found that technical practitioners routinely undermine the privilege structure by writing explicit characterizations of organizational failure, things like "flagrant culture of noncompliance," that lawyers cannot shield and litigants can use. Know what you are writing before an incident forces you to find out why it matters. Standalone cyber policies and property policies respond very differently to nation-state incidents. Cyber insurers paid out on Sony under standalone cyber. The war exclusion fights over NotPetya happened in property insurance courts. If your coverage mix includes both, those are not equivalent protections. The attribution problem cuts both ways. Nation-state actors contracting ransomware groups, or using financially motivated TTPs alongside espionage operations, make war exclusion clauses nearly impossible to apply cleanly. Know where your policy language actually draws that line. Cyber insurance covers more than breach response. Impersonation, deepfake fraud, and privacy violation liability are all coverable under the right policy structure. Most buyers do not realize that until they file a claim. Listen to more episodes:  Apple  Spotify  YouTube Website

In part two of this conversation, Alex Bovicelli, Senior Director of Threat Intelligence at Tokio Marine HCC - Cyber & Professional Lines Group,  gets into what the industry keeps getting wrong about ransomware targeting. The organizations getting hit most often are not the ones making headlines, and the attack methods used against them require far less sophistication than most practitioners assume. Drawing from claims data across thousands of insured companies, Alex explains how groups like Akira have deliberately built around high-volume, low-ransom SMB campaigns, why unpatched MSP tooling is one of the most consistently exploited entry points most defenders aren't tracking, and how a low-tier threat actor sitting on an infected employee machine for six months can hand off access to a major ransomware group. He also breaks down how access brokers are assessing victim maturity, insurance policy status, and organizational structure to decide whether ransomware or BEC delivers the better return, which has nothing to do with CVSS scores. Topics discussed: Why SMBs face structurally different attacks than enterprises, not scaled-down versions Akira's volume-over-value model: ransoms in the $50K-$150K range, thousands of targets, below the threshold that attracts law enforcement attention Unpatched MSP tooling as a lateral movement vehicle the victim never sees coming How a low-tier threat actor's own machine was infected with an info stealer, exposing the 6-7 month timeline between initial access and ransomware deployment How access brokers assess victim maturity, insurance coverage, and org structure to choose between ransomware and BEC for maximum ROI Why criminal exploitability outweighs published vulnerability severity as a patching signal How cyber insurance claims data gives CTI teams visibility into active exploitation before it surfaces publicly Key Takeaways: Stop treating SMB ransomware exposure as a scaled-down version of enterprise risk. The attack methods, economics, and entry points are structurally different, and your defenses need to reflect that. Track SSL VPN brute forcing campaigns specifically. Groups like Akira have optimized these tools to run unattended and return thousands of valid credentials against organizations with no account lockout policies. Enforce account lockout policies and MFA on every remote access entry point. These aren't advanced controls. They're what separates organizations that get hit from those that don't at the SMB level. Audit your MSP's patch posture as part of your own risk assessment. If your MSP is running unpatched tooling, your organization inherits that exposure whether you know about it or not. Integrate info stealer log analysis into your detection pipeline. A low-tier threat actor's infected machine can expose a 6-7 month old foothold and reveal exactly how a major ransomware group obtained initial access. Understand that access brokers are evaluating your organization's maturity, insurance status, and whether you're centralized or decentralized before deciding whether to hit you with ransomware or BEC. Your structural profile affects how you get targeted. Replace CVSS as your primary patching prioritization signal. What access brokers actually care about is ease of exploitation combined with the number of available targets, and your patching sequence should mirror that logic. Use post-claim incident response data to validate and calibrate your pre-claim detection signals. Insurance claims data provides visibility into what is actively being exploited in the wild before it reaches the news cycle. Listen to more episodes:  Apple  Spotify  YouTube Website

Patrick Garrity, Security Researcher at VulnCheck, has a data problem with how the industry prioritizes vulnerabilities, and the data is his own. After manually categorizing roughly 800 exploited vulnerabilities by technology type each year, what he keeps finding is that the CVSS severity distribution of exploited CVEs tracks closely with the overall CVE population. Meaning the scoring system most teams use to decide what gets patched first has no meaningful relationship to what threat actors are actually targeting. He hasn't yet sliced it fully by category, but what's already visible is enough to warrant rethinking your triage logic. He also walks through VulnCheck's exploitation velocity data: roughly 29% of exploited CVEs already have exploitation evidence on or before the day the CVE is published. His read on that number is direct if you're in that bucket, you're likely already compromised before you've had a chance to prioritize the patch. Topics discussed: Why the CVSS severity distribution of exploited CVEs mirrors the overall CVE population Exploitation velocity data: roughly 29% of exploited CVEs have evidence on or before CVE publish date How MFA adoption shifted threat actor focus from credential compromise to direct exploitation Tree map methodology for categorizing 800+ exploited vulnerabilities by technology type annually Cascading vulnerability research: how one high-profile exploit draws threat actors and researchers to adjacent products Source validation framework for assessing reliability across 118+ exploitation evidence reporters Vendor security-through-obscurity blocking defenders from building detections EU Cyber Resilience Act mandating 24-72 hour exploitation disclosure windows in 2026 How Coalition uses vendor risk indices to set cyber insurance rates based on technology stack Key Takeaways:  If your remediation SLAs are gated on CVSS score, you're likely deprioritizing real exposure. Patrick's data shows the severity distribution of what gets exploited tracks the overall CVE population, not a cluster at the critical end. For any CVE where exploitation evidence predates the publish date, treat it as a probable breach, not a patching event. Patrick's framing: you're "likely already compromised." IR engagement should precede remediation, not follow it. When a major exploitation event lands on a product, immediately pull your full inventory for adjacent products in the same technology category. Both threat actors and researchers start looking at related products the moment a category gets attention. Audit your network edge devices for end-of-support and end-of-life status. Many of these products carry 20-30 years of tech debt and were never built with product security as a baseline consideration. When evaluating or renewing network security products, ask the vendor directly: what does your vulnerability disclosure process look like, and is patching automated? If remediation requires a manual change control window every time, that's a structural liability that compounds under pressure. Push back on vendors who restrict patch details or technical indicators to paying customers. Threat actors who already reversed the product don't need that information. Defenders who are trying to build detections do. Look at how insurance carriers like Coalition score your technology stack by vendor risk. If products you're running carry a high-risk rating in those indices, that's worth taking into a vendor conversation or a board briefing it's independent, data-backed validation that your exposure is real. Listen to more episodes:  Apple  Spotify  YouTube Website

Andrew Rathbun, Senior Consultant at Palo Alto Networks Unit 42, has spent years tearing apart Windows endpoints across ransomware, APT, insider threat, and DPRK IT worker cases. His read on the state of enterprise Windows logging is blunt: most organizations have spent significant money on detection tooling while leaving the native forensic record so truncated that proving an intrusion timeline is nearly impossible. He introduces the "conveyor belt of volatility" as a forensic lens, every second, events fall off the back end of your log, and the default sizes Microsoft ships are a relic of 2002 disk economics. Accepting those defaults in a contemporary environment isn't a configuration oversight; it's a gift to the attacker. The conversation goes deep on the four artifacts Andrew calls his sysadmin Christmas list of Sysmon, the Security Event Log, Volume Shadow Copies, and the $J USN Journal, and why each is typically either absent, stale, or undersized when he arrives on a case. He also covers what DPRK IT worker cases look like from the endpoint, why EDR alert queues are generating true positives that go ignored for days, and how he actually uses AI on cases, including a specific example of generating a PowerShell script to convert Linux audit log epoch timestamps to human-readable time, a script he's been running in production for years. Topics discussed: The "conveyor belt of volatility" framework for understanding Windows event log retention Why accepting default log sizes actively shortens the forensic timeline available during incident response Why Sysmon's inclusion in Windows 11 is long overdue, how stale installations with outdated event IDs are a common unforced error in enterprise environments How volume shadow copies can extend forensic visibility across months of attacker activity The $J USN Journal as a file system ledger for every file creation, deletion, rename, and size change on a Windows partition Why EDR is a mandatory but insufficient control, including how alert fatigue causes true positives to be miscategorized as false positives What DPRK fake IT worker cases look like from the endpoint, including the forensic value of USB artifact timestamps How AI functions as a genuine force multiplier in DFIR while remaining unreliable as a source of authoritative forensic ground truth Why GitHub fluency, not tool mastery, is the foundational skill for anyone entering digital forensics Key Takeaways:  Size the Windows Security event log to at least 1 GB. The default 32 MB cycles 4624/4625 events fast enough that authentication history from the week before your incident is already gone. Deploy Sysmon and keep it current. Treat version currency as a security control. Size the $J USN Journal appropriately on all Windows partitions. It's a file system ledger of every create, delete, rename, and resize. Enable volume shadow copies and treat retention depth as a forensic asset.  Alert on event IDs 1102 and System 104. These signal security log and general event log clearing. Audit EDR queues for true positives closed as false positives.   Baseline USB artifact timestamps and KVM device registry entries on remote worker endpoints.  Use AI to parse unfamiliar log syntax and generate one-off scripts — not as forensic ground truth.  Don't assume EDR coverage eliminates the need for native Windows logging. They capture different visibility layers. Build GitHub fluency as a foundational DFIR skill.

After 18 years tracking cybercriminal operations at Trend AI, Robert McArdle, Director of Cybercrime Research, has developed a framework for predicting how threat actors adopt new technology: the answer consistently comes down to economics, not capability. He breaks down three rules of thumb his team uses: criminals want an easy life, any new technology must beat the ROI of their current model, and cybercrime is evolutionary rather than revolutionary. Those rules explain why ransomware has actually slowed the adoption of new attack methods and why the lowering technical barrier for attackers creates an asymmetric burden on defenders, who must demonstrate value to an employer rather than simply make a profit. Robert goes deep on where agentic AI is headed for both offense and defense, including a sobering implication for law enforcement; as criminal operations become increasingly automated, arresting the principals may no longer disrupt the business. His team has already put this to work on the defensive side. Their internal agentic system ACER has discovered 210 zero-days in a matter of months. He also raises a specific concern that practitioners should take seriously: CTI reports containing detailed reverse-engineering write-ups and code samples are essentially training data for malicious LLM prompting, and the industry should reconsider what level of technical detail is actually necessary to publish alongside IOCs. Topics discussed: The three-rule framework for predicting criminal adoption of emerging technology How the lowering technical barrier for entry shifts the entire cybercriminal bell curve upward  Why embedding AI directly into malware remains rare below 1% of observed cases, and the two structural reasons that limit adoption  The shift toward jailbreaking non-Western LLMs as criminal operators anticipate that law enforcement coordination is effectively nonexistent How agentic AI transforms criminal business models from linear service stacks to exponentially scalable operations  The emerging law enforcement challenge when operations are ~75% autonomous, arrests no longer constitute meaningful disruption  Why CTI publishing norms need to evolve, specifically how detailed code samples and reverse-engineering screenshots in APT reports can be fed directly into LLMs to accelerate malware development Practical defensive posture for shadow AI proliferation: treat AI-powered tools as untrusted software under existing vulnerability management frameworks Key Takeaways:  When assessing whether adversaries will adopt a new technique or tool, evaluate it through three lenses: ease of operation, return on investment versus current methods, and evolutionary fit with existing business models. Before publishing detailed reverse-engineering write-ups, code samples, or pseudocode in APT reports, assess whether that level of detail serves defender use cases or primarily serves as a development accelerant for threat actors.  Audit your organization's shadow AI exposure as a software risk problem, not an AI problem.  Structure specialist agents to handle discrete tasks rather than relying on a single broad LLM.  Pressure-test your law enforcement response playbook against autonomous criminal infrastructure.  Evaluate your AI security tooling for hallucination risk in detection workflows.   Model romance scam and investment fraud at scale in your threat landscape.  Monitor for jailbroken non-Western LLM wrappers in criminal marketplaces.  Factor defender tooling complexity into hiring and onboarding benchmarks.  Track zero-day discovery velocity as a benchmark for agentic security ROI.  Listen to more episodes:  Apple  Spotify  YouTube Website

Scott Scher, Cyber Threat Intelligence Lead, makes a distinction that reframes how intel teams should think about their own value: they are forecasters, not predictors. That shift in framing has concrete consequences for how CTI programs justify themselves internally, and Scott argues that the most meaningful metric isn't alert volume or report count, but the decisions intel has actually influenced.  Scott also addresses where he sees the threat landscape heading, and his read on ransomware cuts against how many teams are still oriented. He argues that encryption-focused ransomware has largely peaked in value for attackers; the real shift is toward pure data exfiltration. He also touches on AI in CTI with a grounded take; it’s useful for accelerating manual analyst tasks like data gathering and link analysis, but only if intelligence teams define how it gets used before the organization does it for them. Topics discussed: Why CTI teams operate in the forecasting space rather than the prediction space The practical implications for how assessments are communicated to stakeholders and leadership The challenge of quantifying CTI value through decision-driven metrics rather than output volume Mapping each stakeholder's workflow outputs and the triggers that drive them, then injecting intelligence at the right point in that chain The evolution of ransomware toward exfiltration-only models, and why this reframes the defensive priority from backup to data loss prevention  How CTI teams can use strategic intelligence to drive organizational decisions on edge device hardening and third-party risk The role of AI in intel workflows as a force multiplier for manual analyst tasks, and why teams need to define that use case proactively The collective defense model emerging at the state and local government level Why making analytic assessments scientifically defensible is what separates credible CTI from noise Key Takeaways:  Reframe your team's value proposition around decisions influenced, not products delivered.  Map each stakeholder's workflow before defining your intelligence requirements.  Conduct monthly stakeholder cadences specifically to capture feedback on delivered products.  Ask stakeholders about their biggest obstacles, not just their intel requirements.  Reorient ransomware defensive priorities toward data loss prevention. Use sustained trend analysis to build strategic intelligence cases for resource allocation.  Get ahead of how AI is used in your CTI workflows before organizational pressure defines it for you. Treat qualitative stakeholder feedback as a scientific input, not an afterthought.  Document the reasoning behind every intelligence assessment, not just the conclusion.  Pursue an interdisciplinary lens when building CTI programs and hiring.

Deepfakes have moved well past the uncanny valley and into active threat operations, and Tom Cross, Head of Threat Research at GetReal, has the client-side case studies to back it up. Tom explains how North Korean IT worker infiltration campaigns have transformed HR and video conferencing from administrative functions into active attack surface, albeit one that most security teams aren't monitoring, logging, or ingesting into their SIEM. Drawing on a long-running collaboration with a former West Point professor and intelligence officer, Tom also applies the military framework of tactical, operational, and strategic intelligence to cybersecurity, arguing that most CTI programs are really just lists of burned indicators. The actual value of IOCs, he contends, is retrospective: discovering you were communicating with a known-bad actor means you may still be compromised. He makes the case for connecting adversary intent models, red team findings, and vulnerability data into a unified predictive picture.  YT Thumbnail title: Your Zoom Call Is an Attack Surface Topics discussed: How North Korean IT worker infiltration has converted HR processes and video conferencing into an active, unmonitored attack surface Voice-cloned peer impersonation via messaging apps, followed by deepfaked video calls and malware delivery Why deepfake audio attacks on IT help desk credential reset processes are among the most likely near-term vectors Biometric indicators of compromise and the significant false-positive risks that distinguish them from traditional IP or domain IOCs How the military intelligence framework of tactical, operational, and strategic analysis applies to CTI programs The strategic importance of retrospective IOC analysis versus forward-looking ingestion Why DPRK's financial motivation model expands their target set far beyond what traditional nation-state threat modeling would predict Key Takeaways:  Ingest video conferencing logs into your SIEM. Audit your remote credential reset process for social engineering resistance. Map red team findings and vulnerability data to specific adversary profiles rather than treating them as a generic remediation backlog. Implement retrospective IOC analysis alongside forward-looking blocking. Treat DPRK's financial motivation as an equalizer when assessing APT exposure. Build threat intelligence at the strategic layer by modeling adversary intent and objectives, not just cataloging observed TTPs. Apply extra care to biometric IOC sharing. Monitor employee working-hour patterns against claimed time zones as a behavioral indicator of potential employment fraud. Extend IOC taxonomy to include multimedia and biometric formats. Listen to more episodes:  Apple  Spotify  YouTube Website

Vincent Passaro, Engineering Manager at Stripe Security, didn't get there through a slide deck or a company mandate. He got there through a shower thought that followed a conversation with a friend, and it broke how he'd been thinking about building, leading, and even measuring his own team. The reframe was simple and did not start with "we're all going to be software developers. Rather, "we're going to be product owners." That single pivot changed everything downstream, including how he approached prototyping, how he set success criteria for agents, and how he coached his team out of chasing bugs and into defining outcomes. In this episode, Will and Vince trace both of their "pin drop" moments: the specific conversations that shifted their mental models, then try to articulate what that shift actually means for CTI analysts and security engineers working real problems today. They talk about what it felt like to stop asking "how do I wire this" and start asking "what does success look like," and how fast things moved once that happened. They're honest about what breaks, like the siloed tools that don't talk to each other, the governance vacuum that opens when every analyst is shipping products, and the dopamine trap of adding features instead of finishing work. And they're equally direct about what becomes possible when outcome velocity: not headcount or tooling budget, and what becomes the competitive edge. This isn't a conversation about AI hype. It's about what happens when two practitioners who've spent years operating the plumbing realize the plumbing has been commoditized and what that means for where human judgment actually matters now. If you've been waiting for the right moment to pay attention, this is probably the episode where you stop waiting. Topics Discussed "Product owner" vs. "developer" mindset and why it changes how analysts build toolingDefining outcome criteria upfront as the core discipline for AI-assisted developmentHow AI collapses experimentation costs and eliminates dev team dependencyAnalyst-owned toolkits and outcome velocity as a competitive edge for small teamsThe governance risk: product silos, duplicated tooling, and inconsistent standardsFT3 as an open-source framework built to lower the community contribution barrierWhy CISO/board resistance to AI on security grounds will backfireThreat actors are scaling the same way — analyst adaptation is the necessary responseKey Takeaways:  The unlock isn't learning to code: it's learning to think backwards from the outcome.  Define what success looks like, set the criteria the agent has to meet before it moves on, and stop micromanaging the implementation. That's the product owner shift. Slow down before you build. Spend more time in planning than in execution using deep research across multiple models, comparing outputs, stress-testing the concept before a single line gets written. Drop the subscription and treat the model like a teacher, not a tool. Start with a problem you already understand. Ask it to walk you from zero to fluent. It will tell you to stop thinking like a developer and start thinking like a product owner.  If you have a backlog of problems you gave up on because they weren't staffable, go find them. The feasibility question that used to take months to answer now takes an afternoon. Start there. Before your next team planning cycle, map what everyone is building. The duplicate tools are already being written in parallel by people who don't know about each other. Get ahead of it now, because it only compounds. If you're involved in open-source threat intel frameworks, the contribution problem was never motivation, it was friction. The tooling gap is closable. Build the on-ramp and the community will use it. Listen to more episodes:  Apple  Spotify  YouTube Website

What happens when a DPRK IT worker operation lands inside one of your clients, and the three-letter agency you call says they can't show up? Duaine Labno, Director of Special Investigations & Threat Intelligence at TIG Risk Services, walks through exactly that case: his team built a ruse to recover the compromised laptop, staged a physical handoff at corporate HQ, filmed the courier, ran his plates, and traced him to multiple properties.  This produced the kind of ground-level intelligence the FBI told him they'd never seen before in a US-based DPRK case. Duaine explains why digital and physical investigations have to run in parallel from day one, not handed off sequentially, and what that looks like operationally when federal resources don't materialize. He also breaks down how post-COVID remote hiring processes that are speed-optimized gave adversaries a repeatable entry point, and why an untrained recruiter doing a soft document check is now a meaningful attack surface for corporate networks. YT Thumbnail title: Remote Hiring Broke Your Security Perimeter Topics discussed: How post-COVID remote hiring processes relaxed identity verification standards and created repeatable enterprise network entry points  Running parallel digital and physical investigations simultaneously when tracking identity fraud and insider threats Using open-source intelligence and proprietary threat monitoring software to scan millions of data points for suspect behavioral patterns Executing a live DPRK IT worker case using physical surveillance, a document ruse, and plate runs to identify a U.S.-based operator Why untrained recruiters conducting soft document checks have become a meaningful attack surface in corporate hiring pipelines How adversaries are weaponizing AI for voice alteration, deepfakes, and document manipulation to bypass hiring and KYC verification processes The case for vetted, secure cross-industry intelligence sharing platforms to close gaps that individual organizational silos leave open Where cyber threat intelligence trails end and physical investigation must pick up to produce actionable, court-ready evidence Key Takeaways:  Treat remote hiring pipelines as an active attack surface by pulling security, legal, and HR into the process. Train recruiters to recognize fraudulent identity documents as a first line of defense against adversarial infiltration of corporate networks. Run digital and physical investigations in parallel from the start rather than waiting for cyber analysis to conclude. Build contingency plans for federal non-response into any investigation involving foreign threat actors. Deploy threat monitoring software capable of scanning open-source data at scale to surface behavioral patterns and connections. Establish vetted, secure intelligence sharing relationships with peer organizations and law enforcement to close the visibility gaps. Pressure-test AI-assisted hiring tools against deepfake and voice alteration scenarios before deploying them. Listen to more episodes:  Apple  Spotify  YouTube Website